[Ethereal-users] Meaning of Trailer in Ethernet frames

[Arnold Nipper <arnold@xxxxxxxxx>]

I would have expected that the "Trailer" as in

Frame 316560 (60 bytes on wire, 60 bytes captured)
     Arrival Time: May 26, 2005 21:15:44.694770000
     Time delta from previous packet: 0.000141000 seconds
     Time since reference or first frame: 43.566940000 seconds
     Frame Number: 316560
     Packet Length: 60 bytes
     Capture Length: 60 bytes
Ethernet II, Src: xx:xx:xx:xx:xx, Dst: ff:ff:ff:ff:ff:ff
     Destination: ff:ff:ff:ff:ff:ff (ff:ff:ff:ff:ff:ff)
     Source: xx:xx:xx:xx:xx (xx:xx:xx:xx:xx)
     Type: ARP (0x0806)
     Trailer: 0000020100020100430500D89EBC6C30...
Address Resolution Protocol (request)
     Hardware type: Ethernet (0x0001)
     Protocol type: IP (0x0800)
     Hardware size: 6
     Protocol size: 4
     Opcode: request (0x0001)
     Sender MAC address: xx:xx:xx:xx:xx (xx:xx:xx:xx:xx)
     Sender IP address: X.X.X.X (X.X.X.X)
     Target MAC address: 00:00:00:00:00:00 (00:00:00:00:00:00)
     Target IP address: Y.Y.Y.Y (Y.Y.Y.Y)

is always the same when Sender MAC/IP address, Target IP address and 
Destination (here: broadcast) is always the same or always different 
(modulo 2^lenght).

But when looking at roughly 9200 frames I found only 34 different 
Trailers with frequency ranging from 1 to ~5900.

Or does the same Trailer indicate that the frame was counted twice due 
to L2 loop?

I'm using

tethereal -v
tethereal 0.10.6
Compiled with GLib 1.2.10, with libpcap 0.7.2, with libz 1.1.4, without 
libpcre,
without UCD-SNMP or Net-SNMP, without ADNS.
NOTE: this build does not support the "matches" operator for Ethereal filter
syntax.
Running with libpcap (version unknown) on SunOS 5.9.



Best regards, Arnold
--
Arnold Nipper, AN45